CVE-2026-109619

PHP runs most of the web. On 21 October 2026 it got a critical security hole called PHP2Shell. It is two bugs inside PHP itself (CVE-2026-109618 and CVE-2026-109619), both rated 9.2 out of 10. An attacker needs no login. Your code can be perfect and the server is still exposed. https://t.co/I9ZuRNE…

PHPから新たな脆弱性CVE-2026-115560が発表されました。21日発表の脆弱性CVE-2026-109619より限定的で緊急パッチは出ず、次回リリースまで暫定処置として session.upload_progress.enabled = 0 のままにしておくことが推奨。 https://t.co/Z3yrqeMEqw

A critical flaw in PHP itself went public on 21 October 2026. It's called PHP2Shell (CVE-2026-109618 and CVE-2026-109619), it is rated 9.2 out of 10, and it allows unauthenticated remote code execution on unpatched servers. Exploitation has already been reported. #PHP #PHP2Shell

PHP2Shell: guía completa de verificación, mitigación y respuesta (CVE-2026-109618 y CVE-2026-109619) Vía: @SeguInfo https://t.co/PNzsuc6cvu https://t.co/UHIOmO6aAr

Builders — while everyone is patching PHP2Shell, let's talk about why it happened. 2 days ago: PHP dropped emergency patches CVE-2026-109618 + CVE-2026-109619 — CVSS 9.2. 22.6M servers exposed. Amazon saw exploit in wild Oct 17, 4 days BEFORE patch. Root cause in plain English: PHP runs out of memo…

This week in AI (Oct 19-23): models found a critical hole in the web's most common server language, agents were pointed at thousands of tenants, and banks started shutting agents out. The checks around agents are what moved fastest. Five developments worth following: 1. AI-found PHP flaws force eme…

PHP2Shell (CVE-2026-109618 & CVE-2026-109619) — Critical PHP Core RCE Analysis PHP2Shell is a pair of critical memory-safety bugs in the PHP engine itself (not in WordPress, Laravel, plugins, or app code). An unauthenticated attacker can trigger remote code execution simply by sending crafted HTTP…

Die National Security Agency fordert Organisationen mit PHP-Systemen auf, ein Update gegen zwei kritische Schwachstellen vorzubereiten oder betroffene Systeme offline zu nehmen. Die NSA veröffentlichte am 21. Oktober 2026 eine entsprechende Advisory und kündigte kurzfristig detailliertere Anleitung…

The flaws behind php2shell have been in PHP for over a decade, back to 5.4. Two CVSS 9.2 bugs (CVE-2026-109618, CVE-2026-109619) allow unauthenticated remote code execution, and your app doesn't need its own bug. WordPress, Drupal and Joomla were all shown exploitable.

Para todas aquellas que utilizáis PHP, estáis en PELIGRO. CODIGOS DE VULNERABILIDAD: CVE-2026-109618 y CVE-2026-109619

imaginal/docker-php74-trixie: Docker Image php:7.4-fpm with security fixes for CVE-2026-109618 and CVE-2026-109619 updated to build and run on Debian Trixie

Ghost-Bx1/php-exploits-CVE-2026-109618-CVE-2026-109619-CVE-2024-4577: Full exploits and PoCs for php2shell (CVE-2026-109618, CVE-2026-109619) and CVE-2024-4577 - PHP critical RCE (CVSS 9.2-9.8)

manteiga-foundation/php2shell-labs: Is your server exposed to PHP2Shell? Free, open-source exposure test and consent-gated exploit validation for CVE-2026-109618 / CVE-2026-109619. Web, API and CLI.

ihsansencan/Php2Shell-Lab: Educational Docker lab for CVE-2026-109618 / CVE-2026-109619 — pre-auth RCE in PHP 8.4.x

Nguemoue/project2026_20261023_php_rce_guard: Vérifie si une version PHP est encore exposée aux RCE du 21 octobre 2026 (CVE-2026-109618, CVE-2026-109619) et rappelle le suivi CVE-2026-115560.

ionsec/php2shell-detector: php2shell-detector - local + network detections for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by IONSEC. Python CLI: host posture, access-log fingerprints, binary drift; plus Sigma, Suricata, ModSecurity rules and curated references.

abenezer101/php2shell: Scans a domain for CVE-2026-109618 / CVE-2026-109619 (php2shell) exposure, then audits and fixes the vulnerable PHP runtime pin in your code base. Python, stdlib only

sanketkokate712/php2shell-fix: Claude Code skill + scripts to find, patch and verify PHP2Shell (CVE-2026-109618, CVE-2026-109619) on any PHP server

SANAULLAH-AI/php2shell-safe-learning-lab: An educational PHP2Shell (CVE-2026-109618 / CVE-2026-109619) learning lab demonstrating HTTP upload handling, memory-safety concepts, safe request simulation, and defensive monitoring. Includes Python examples, Docker setup, unit tests, and a beginner-frien…

jniedergang/php74-el7-php2shell: Unofficial EL7 rebuild of Remi's php74 SCL packages with the PHP2Shell fix (CVE-2026-109618, CVE-2026-109619). Not supported by SUSE, Red Hat or Remi.

How the Planet Gets Hacked in Seconds (and Why Updating Isn't Optional) — How the Planet Gets Hacked in Seconds (and Why Updating Isn't Optional) You don't get a month to patch anymore. You get hours. Sometimes you don't even get that. On October 21, 2026, PHP shipped emergency fixes for PHP2Shell,…

Amazon Threat Intelligence identifies PHP2Shell exploitation prior to public disclosure in MadPot | Amazon Web Services — New technical findings make the PHP2Shell situation more serious than the original patch announcement alone suggested. Amazon Threat Intelligence identified attempted exploitati…

PHP2Shell: the useful question isn't "are we patched", it's "where is PHP actually running in our environment" — Quick recap for anyone catching up. The leaked PHP RCEs (CVE-2026-109618 and CVE-2026-109619) were exploited before the fix landed. AWS's MadPot honeypots saw an attempt on 17 Oct, and t…

PHP2Shell: patching priorities, exposure checks, and the limits of virtual patching — CVE-2026-109618 and CVE-2026-109619, collectively known as PHP2Shell, can allow unauthenticated remote code execution through memory corruption and request lifecycle issues in PHP. For defenders, a key challenge i…

Two critical PHP RCE flaws, tracked as PHP2Shell, leaked ahead of coordinated disclosure. — → CVE-2026-109618 and CVE-2026-109619, both rated 9.2 (CVSS v4.0) → PHP’s security release is scheduled for October 21 at 14:00 UTC → Fixes are coming for supported branches 8.2 through 8.5 → End-of-life ver…

CVE-2026-109618 and CVE-2026-109619 Are Two Directions Through the Same Pre-RINIT Window — Leak hit HN 2026-10-20 15:20Z. PHP 8.5.12 / 8.4.27 / 8.3.36 / 8.2.35 fix both CVEs. Mechanism: php_request_startup() calls php_hash_environment() (multipart parse, the session.upload_progress callback, php_se…

Over a decade in PHP's codebase. AI made it exploitable in a week. — Two critical vulnerabilities in PHP itself (CVE-2026-109618 and CVE-2026-109619, CVSS 9.2). Unauthenticated RCE and remote memory disclosure. Not a WordPress or Drupal bug, but the PHP engine itself. The interesting part? These vu…

// SITUATIONAL AWARENESS // php2shell: CVE-2026-109618 & CVE-2026-109619 — PHP has announced two critical-severity CVEs in PHP. Both vulnerabilities can lead to remote code execution (RCE) and further adversary actions on systems running unpatched versions of PHP. Customers should prioritize patchi…

PHP emergency release drops today. How are you finding the PHP you don't know you're running? — Two critical PHP core RCEs (CVE-2026-109618 and CVE-2026-109619) leaked before disclosure, and the fixed releases are due today at 14:00 UTC. Reports say PHP 5 to 8 are affected and EOL branches may get…

Upcoming PHP core RCE vulnerability patches (CVE-2026-109618 & CVE-2026-109619) — A heads up in case you weren't aware, a patch is being released tomorrow for two RCEs found in PHP core by Calif\1].) It affects PHP version 5 onwards\2].) The RCE appears to work on default installations of many comm…